2 * Linux NET3: IP/IP protocol decoder modified to support
3 * virtual tunnel interface
6 * Saurabh Mohan (saurabh.mohan@vyatta.com) 05/07/2012
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License
10 * as published by the Free Software Foundation; either version
11 * 2 of the License, or (at your option) any later version.
16 This version of net/ipv4/ip_vti.c is cloned of net/ipv4/ipip.c
18 For comments look at net/ipv4/ip_gre.c --ANK
22 #include <linux/capability.h>
23 #include <linux/module.h>
24 #include <linux/types.h>
25 #include <linux/kernel.h>
26 #include <linux/uaccess.h>
27 #include <linux/skbuff.h>
28 #include <linux/netdevice.h>
30 #include <linux/tcp.h>
31 #include <linux/udp.h>
32 #include <linux/if_arp.h>
33 #include <linux/init.h>
34 #include <linux/netfilter_ipv4.h>
35 #include <linux/if_ether.h>
36 #include <linux/icmpv6.h>
41 #include <net/ip_tunnels.h>
42 #include <net/inet_ecn.h>
44 #include <net/net_namespace.h>
45 #include <net/netns/generic.h>
47 static struct rtnl_link_ops vti_link_ops __read_mostly
;
49 static unsigned int vti_net_id __read_mostly
;
50 static int vti_tunnel_init(struct net_device
*dev
);
52 static int vti_input(struct sk_buff
*skb
, int nexthdr
, __be32 spi
,
55 struct ip_tunnel
*tunnel
;
56 const struct iphdr
*iph
= ip_hdr(skb
);
57 struct net
*net
= dev_net(skb
->dev
);
58 struct ip_tunnel_net
*itn
= net_generic(net
, vti_net_id
);
60 tunnel
= ip_tunnel_lookup(itn
, skb
->dev
->ifindex
, TUNNEL_NO_KEY
,
61 iph
->saddr
, iph
->daddr
, 0);
63 if (!xfrm4_policy_check(NULL
, XFRM_POLICY_IN
, skb
))
66 XFRM_TUNNEL_SKB_CB(skb
)->tunnel
.ip4
= tunnel
;
68 return xfrm_input(skb
, nexthdr
, spi
, encap_type
);
77 static int vti_rcv(struct sk_buff
*skb
)
79 XFRM_SPI_SKB_CB(skb
)->family
= AF_INET
;
80 XFRM_SPI_SKB_CB(skb
)->daddroff
= offsetof(struct iphdr
, daddr
);
82 return vti_input(skb
, ip_hdr(skb
)->protocol
, 0, 0);
85 static int vti_rcv_cb(struct sk_buff
*skb
, int err
)
87 unsigned short family
;
88 struct net_device
*dev
;
89 struct pcpu_sw_netstats
*tstats
;
91 struct xfrm_mode
*inner_mode
;
92 struct ip_tunnel
*tunnel
= XFRM_TUNNEL_SKB_CB(skb
)->tunnel
.ip4
;
93 u32 orig_mark
= skb
->mark
;
102 dev
->stats
.rx_errors
++;
103 dev
->stats
.rx_dropped
++;
108 x
= xfrm_input_state(skb
);
110 inner_mode
= x
->inner_mode
;
112 if (x
->sel
.family
== AF_UNSPEC
) {
113 inner_mode
= xfrm_ip2inner_mode(x
, XFRM_MODE_SKB_CB(skb
)->protocol
);
114 if (inner_mode
== NULL
) {
115 XFRM_INC_STATS(dev_net(skb
->dev
),
116 LINUX_MIB_XFRMINSTATEMODEERROR
);
121 family
= inner_mode
->afinfo
->family
;
123 skb
->mark
= be32_to_cpu(tunnel
->parms
.i_key
);
124 ret
= xfrm_policy_check(NULL
, XFRM_POLICY_IN
, skb
, family
);
125 skb
->mark
= orig_mark
;
130 skb_scrub_packet(skb
, !net_eq(tunnel
->net
, dev_net(skb
->dev
)));
133 tstats
= this_cpu_ptr(dev
->tstats
);
135 u64_stats_update_begin(&tstats
->syncp
);
136 tstats
->rx_packets
++;
137 tstats
->rx_bytes
+= skb
->len
;
138 u64_stats_update_end(&tstats
->syncp
);
143 static bool vti_state_check(const struct xfrm_state
*x
, __be32 dst
, __be32 src
)
145 xfrm_address_t
*daddr
= (xfrm_address_t
*)&dst
;
146 xfrm_address_t
*saddr
= (xfrm_address_t
*)&src
;
148 /* if there is no transform then this tunnel is not functional.
149 * Or if the xfrm is not mode tunnel.
151 if (!x
|| x
->props
.mode
!= XFRM_MODE_TUNNEL
||
152 x
->props
.family
!= AF_INET
)
156 return xfrm_addr_equal(saddr
, &x
->props
.saddr
, AF_INET
);
158 if (!xfrm_state_addr_check(x
, daddr
, saddr
, AF_INET
))
164 static netdev_tx_t
vti_xmit(struct sk_buff
*skb
, struct net_device
*dev
,
167 struct ip_tunnel
*tunnel
= netdev_priv(dev
);
168 struct ip_tunnel_parm
*parms
= &tunnel
->parms
;
169 struct dst_entry
*dst
= skb_dst(skb
);
170 struct net_device
*tdev
; /* Device to other host */
171 int pkt_len
= skb
->len
;
176 dev
->stats
.tx_carrier_errors
++;
181 dst
= xfrm_lookup(tunnel
->net
, dst
, fl
, NULL
, 0);
183 dev
->stats
.tx_carrier_errors
++;
187 if (!vti_state_check(dst
->xfrm
, parms
->iph
.daddr
, parms
->iph
.saddr
)) {
188 dev
->stats
.tx_carrier_errors
++;
197 dev
->stats
.collisions
++;
201 if (tunnel
->err_count
> 0) {
202 if (time_before(jiffies
,
203 tunnel
->err_time
+ IPTUNNEL_ERR_TIMEO
)) {
205 dst_link_failure(skb
);
207 tunnel
->err_count
= 0;
211 if (skb
->len
> mtu
) {
212 skb_dst(skb
)->ops
->update_pmtu(skb_dst(skb
), NULL
, skb
, mtu
);
213 if (skb
->protocol
== htons(ETH_P_IP
)) {
214 icmp_send(skb
, ICMP_DEST_UNREACH
, ICMP_FRAG_NEEDED
,
217 if (mtu
< IPV6_MIN_MTU
)
220 icmpv6_send(skb
, ICMPV6_PKT_TOOBIG
, 0, mtu
);
227 skb_scrub_packet(skb
, !net_eq(tunnel
->net
, dev_net(dev
)));
228 skb_dst_set(skb
, dst
);
229 skb
->dev
= skb_dst(skb
)->dev
;
231 err
= dst_output(tunnel
->net
, skb
->sk
, skb
);
232 if (net_xmit_eval(err
) == 0)
234 iptunnel_xmit_stats(dev
, err
);
238 dst_link_failure(skb
);
240 dev
->stats
.tx_errors
++;
245 /* This function assumes it is being called from dev_queue_xmit()
246 * and that skb is filled properly by that function.
248 static netdev_tx_t
vti_tunnel_xmit(struct sk_buff
*skb
, struct net_device
*dev
)
250 struct ip_tunnel
*tunnel
= netdev_priv(dev
);
253 memset(&fl
, 0, sizeof(fl
));
255 switch (skb
->protocol
) {
256 case htons(ETH_P_IP
):
257 xfrm_decode_session(skb
, &fl
, AF_INET
);
258 memset(IPCB(skb
), 0, sizeof(*IPCB(skb
)));
260 case htons(ETH_P_IPV6
):
261 xfrm_decode_session(skb
, &fl
, AF_INET6
);
262 memset(IP6CB(skb
), 0, sizeof(*IP6CB(skb
)));
265 dev
->stats
.tx_errors
++;
270 /* override mark with tunnel output key */
271 fl
.flowi_mark
= be32_to_cpu(tunnel
->parms
.o_key
);
273 return vti_xmit(skb
, dev
, &fl
);
276 static int vti4_err(struct sk_buff
*skb
, u32 info
)
280 struct xfrm_state
*x
;
281 struct ip_tunnel
*tunnel
;
282 struct ip_esp_hdr
*esph
;
283 struct ip_auth_hdr
*ah
;
284 struct ip_comp_hdr
*ipch
;
285 struct net
*net
= dev_net(skb
->dev
);
286 const struct iphdr
*iph
= (const struct iphdr
*)skb
->data
;
287 int protocol
= iph
->protocol
;
288 struct ip_tunnel_net
*itn
= net_generic(net
, vti_net_id
);
290 tunnel
= ip_tunnel_lookup(itn
, skb
->dev
->ifindex
, TUNNEL_NO_KEY
,
291 iph
->daddr
, iph
->saddr
, 0);
295 mark
= be32_to_cpu(tunnel
->parms
.o_key
);
299 esph
= (struct ip_esp_hdr
*)(skb
->data
+(iph
->ihl
<<2));
303 ah
= (struct ip_auth_hdr
*)(skb
->data
+(iph
->ihl
<<2));
307 ipch
= (struct ip_comp_hdr
*)(skb
->data
+(iph
->ihl
<<2));
308 spi
= htonl(ntohs(ipch
->cpi
));
314 switch (icmp_hdr(skb
)->type
) {
315 case ICMP_DEST_UNREACH
:
316 if (icmp_hdr(skb
)->code
!= ICMP_FRAG_NEEDED
)
324 x
= xfrm_state_lookup(net
, mark
, (const xfrm_address_t
*)&iph
->daddr
,
325 spi
, protocol
, AF_INET
);
329 if (icmp_hdr(skb
)->type
== ICMP_DEST_UNREACH
)
330 ipv4_update_pmtu(skb
, net
, info
, 0, 0, protocol
, 0);
332 ipv4_redirect(skb
, net
, 0, 0, protocol
, 0);
339 vti_tunnel_ioctl(struct net_device
*dev
, struct ifreq
*ifr
, int cmd
)
342 struct ip_tunnel_parm p
;
344 if (copy_from_user(&p
, ifr
->ifr_ifru
.ifru_data
, sizeof(p
)))
347 if (cmd
== SIOCADDTUNNEL
|| cmd
== SIOCCHGTUNNEL
) {
348 if (p
.iph
.version
!= 4 || p
.iph
.protocol
!= IPPROTO_IPIP
||
353 if (!(p
.i_flags
& GRE_KEY
))
355 if (!(p
.o_flags
& GRE_KEY
))
358 p
.i_flags
= VTI_ISVTI
;
360 err
= ip_tunnel_ioctl(dev
, &p
, cmd
);
364 if (cmd
!= SIOCDELTUNNEL
) {
365 p
.i_flags
|= GRE_KEY
;
366 p
.o_flags
|= GRE_KEY
;
369 if (copy_to_user(ifr
->ifr_ifru
.ifru_data
, &p
, sizeof(p
)))
374 static const struct net_device_ops vti_netdev_ops
= {
375 .ndo_init
= vti_tunnel_init
,
376 .ndo_uninit
= ip_tunnel_uninit
,
377 .ndo_start_xmit
= vti_tunnel_xmit
,
378 .ndo_do_ioctl
= vti_tunnel_ioctl
,
379 .ndo_change_mtu
= ip_tunnel_change_mtu
,
380 .ndo_get_stats64
= ip_tunnel_get_stats64
,
381 .ndo_get_iflink
= ip_tunnel_get_iflink
,
384 static void vti_tunnel_setup(struct net_device
*dev
)
386 dev
->netdev_ops
= &vti_netdev_ops
;
387 dev
->type
= ARPHRD_TUNNEL
;
388 ip_tunnel_setup(dev
, vti_net_id
);
391 static int vti_tunnel_init(struct net_device
*dev
)
393 struct ip_tunnel
*tunnel
= netdev_priv(dev
);
394 struct iphdr
*iph
= &tunnel
->parms
.iph
;
396 memcpy(dev
->dev_addr
, &iph
->saddr
, 4);
397 memcpy(dev
->broadcast
, &iph
->daddr
, 4);
399 dev
->hard_header_len
= LL_MAX_HEADER
+ sizeof(struct iphdr
);
400 dev
->mtu
= ETH_DATA_LEN
;
401 dev
->flags
= IFF_NOARP
;
403 dev
->features
|= NETIF_F_LLTX
;
406 return ip_tunnel_init(dev
);
409 static void __net_init
vti_fb_tunnel_init(struct net_device
*dev
)
411 struct ip_tunnel
*tunnel
= netdev_priv(dev
);
412 struct iphdr
*iph
= &tunnel
->parms
.iph
;
415 iph
->protocol
= IPPROTO_IPIP
;
419 static struct xfrm4_protocol vti_esp4_protocol __read_mostly
= {
421 .input_handler
= vti_input
,
422 .cb_handler
= vti_rcv_cb
,
423 .err_handler
= vti4_err
,
427 static struct xfrm4_protocol vti_ah4_protocol __read_mostly
= {
429 .input_handler
= vti_input
,
430 .cb_handler
= vti_rcv_cb
,
431 .err_handler
= vti4_err
,
435 static struct xfrm4_protocol vti_ipcomp4_protocol __read_mostly
= {
437 .input_handler
= vti_input
,
438 .cb_handler
= vti_rcv_cb
,
439 .err_handler
= vti4_err
,
443 static int __net_init
vti_init_net(struct net
*net
)
446 struct ip_tunnel_net
*itn
;
448 err
= ip_tunnel_init_net(net
, vti_net_id
, &vti_link_ops
, "ip_vti0");
451 itn
= net_generic(net
, vti_net_id
);
452 vti_fb_tunnel_init(itn
->fb_tunnel_dev
);
456 static void __net_exit
vti_exit_net(struct net
*net
)
458 struct ip_tunnel_net
*itn
= net_generic(net
, vti_net_id
);
459 ip_tunnel_delete_net(itn
, &vti_link_ops
);
462 static struct pernet_operations vti_net_ops
= {
463 .init
= vti_init_net
,
464 .exit
= vti_exit_net
,
466 .size
= sizeof(struct ip_tunnel_net
),
469 static int vti_tunnel_validate(struct nlattr
*tb
[], struct nlattr
*data
[],
470 struct netlink_ext_ack
*extack
)
475 static void vti_netlink_parms(struct nlattr
*data
[],
476 struct ip_tunnel_parm
*parms
,
479 memset(parms
, 0, sizeof(*parms
));
481 parms
->iph
.protocol
= IPPROTO_IPIP
;
486 parms
->i_flags
= VTI_ISVTI
;
488 if (data
[IFLA_VTI_LINK
])
489 parms
->link
= nla_get_u32(data
[IFLA_VTI_LINK
]);
491 if (data
[IFLA_VTI_IKEY
])
492 parms
->i_key
= nla_get_be32(data
[IFLA_VTI_IKEY
]);
494 if (data
[IFLA_VTI_OKEY
])
495 parms
->o_key
= nla_get_be32(data
[IFLA_VTI_OKEY
]);
497 if (data
[IFLA_VTI_LOCAL
])
498 parms
->iph
.saddr
= nla_get_in_addr(data
[IFLA_VTI_LOCAL
]);
500 if (data
[IFLA_VTI_REMOTE
])
501 parms
->iph
.daddr
= nla_get_in_addr(data
[IFLA_VTI_REMOTE
]);
503 if (data
[IFLA_VTI_FWMARK
])
504 *fwmark
= nla_get_u32(data
[IFLA_VTI_FWMARK
]);
507 static int vti_newlink(struct net
*src_net
, struct net_device
*dev
,
508 struct nlattr
*tb
[], struct nlattr
*data
[],
509 struct netlink_ext_ack
*extack
)
511 struct ip_tunnel_parm parms
;
514 vti_netlink_parms(data
, &parms
, &fwmark
);
515 return ip_tunnel_newlink(dev
, tb
, &parms
, fwmark
);
518 static int vti_changelink(struct net_device
*dev
, struct nlattr
*tb
[],
519 struct nlattr
*data
[],
520 struct netlink_ext_ack
*extack
)
522 struct ip_tunnel
*t
= netdev_priv(dev
);
523 __u32 fwmark
= t
->fwmark
;
524 struct ip_tunnel_parm p
;
526 vti_netlink_parms(data
, &p
, &fwmark
);
527 return ip_tunnel_changelink(dev
, tb
, &p
, fwmark
);
530 static size_t vti_get_size(const struct net_device
*dev
)
541 /* IFLA_VTI_REMOTE */
543 /* IFLA_VTI_FWMARK */
548 static int vti_fill_info(struct sk_buff
*skb
, const struct net_device
*dev
)
550 struct ip_tunnel
*t
= netdev_priv(dev
);
551 struct ip_tunnel_parm
*p
= &t
->parms
;
553 if (nla_put_u32(skb
, IFLA_VTI_LINK
, p
->link
) ||
554 nla_put_be32(skb
, IFLA_VTI_IKEY
, p
->i_key
) ||
555 nla_put_be32(skb
, IFLA_VTI_OKEY
, p
->o_key
) ||
556 nla_put_in_addr(skb
, IFLA_VTI_LOCAL
, p
->iph
.saddr
) ||
557 nla_put_in_addr(skb
, IFLA_VTI_REMOTE
, p
->iph
.daddr
) ||
558 nla_put_u32(skb
, IFLA_VTI_FWMARK
, t
->fwmark
))
564 static const struct nla_policy vti_policy
[IFLA_VTI_MAX
+ 1] = {
565 [IFLA_VTI_LINK
] = { .type
= NLA_U32
},
566 [IFLA_VTI_IKEY
] = { .type
= NLA_U32
},
567 [IFLA_VTI_OKEY
] = { .type
= NLA_U32
},
568 [IFLA_VTI_LOCAL
] = { .len
= FIELD_SIZEOF(struct iphdr
, saddr
) },
569 [IFLA_VTI_REMOTE
] = { .len
= FIELD_SIZEOF(struct iphdr
, daddr
) },
570 [IFLA_VTI_FWMARK
] = { .type
= NLA_U32
},
573 static struct rtnl_link_ops vti_link_ops __read_mostly
= {
575 .maxtype
= IFLA_VTI_MAX
,
576 .policy
= vti_policy
,
577 .priv_size
= sizeof(struct ip_tunnel
),
578 .setup
= vti_tunnel_setup
,
579 .validate
= vti_tunnel_validate
,
580 .newlink
= vti_newlink
,
581 .changelink
= vti_changelink
,
582 .dellink
= ip_tunnel_dellink
,
583 .get_size
= vti_get_size
,
584 .fill_info
= vti_fill_info
,
585 .get_link_net
= ip_tunnel_get_link_net
,
588 static bool is_vti_tunnel(const struct net_device
*dev
)
590 return dev
->netdev_ops
== &vti_netdev_ops
;
593 static int vti_device_event(struct notifier_block
*unused
,
594 unsigned long event
, void *ptr
)
596 struct net_device
*dev
= netdev_notifier_info_to_dev(ptr
);
597 struct ip_tunnel
*tunnel
= netdev_priv(dev
);
599 if (!is_vti_tunnel(dev
))
604 if (!net_eq(tunnel
->net
, dev_net(dev
)))
605 xfrm_garbage_collect(tunnel
->net
);
611 static struct notifier_block vti_notifier_block __read_mostly
= {
612 .notifier_call
= vti_device_event
,
615 static int __init
vti_init(void)
620 pr_info("IPv4 over IPsec tunneling driver\n");
622 register_netdevice_notifier(&vti_notifier_block
);
624 msg
= "tunnel device";
625 err
= register_pernet_device(&vti_net_ops
);
627 goto pernet_dev_failed
;
629 msg
= "tunnel protocols";
630 err
= xfrm4_protocol_register(&vti_esp4_protocol
, IPPROTO_ESP
);
632 goto xfrm_proto_esp_failed
;
633 err
= xfrm4_protocol_register(&vti_ah4_protocol
, IPPROTO_AH
);
635 goto xfrm_proto_ah_failed
;
636 err
= xfrm4_protocol_register(&vti_ipcomp4_protocol
, IPPROTO_COMP
);
638 goto xfrm_proto_comp_failed
;
640 msg
= "netlink interface";
641 err
= rtnl_link_register(&vti_link_ops
);
643 goto rtnl_link_failed
;
648 xfrm4_protocol_deregister(&vti_ipcomp4_protocol
, IPPROTO_COMP
);
649 xfrm_proto_comp_failed
:
650 xfrm4_protocol_deregister(&vti_ah4_protocol
, IPPROTO_AH
);
651 xfrm_proto_ah_failed
:
652 xfrm4_protocol_deregister(&vti_esp4_protocol
, IPPROTO_ESP
);
653 xfrm_proto_esp_failed
:
654 unregister_pernet_device(&vti_net_ops
);
656 unregister_netdevice_notifier(&vti_notifier_block
);
657 pr_err("vti init: failed to register %s\n", msg
);
661 static void __exit
vti_fini(void)
663 rtnl_link_unregister(&vti_link_ops
);
664 xfrm4_protocol_deregister(&vti_ipcomp4_protocol
, IPPROTO_COMP
);
665 xfrm4_protocol_deregister(&vti_ah4_protocol
, IPPROTO_AH
);
666 xfrm4_protocol_deregister(&vti_esp4_protocol
, IPPROTO_ESP
);
667 unregister_pernet_device(&vti_net_ops
);
668 unregister_netdevice_notifier(&vti_notifier_block
);
671 module_init(vti_init
);
672 module_exit(vti_fini
);
673 MODULE_LICENSE("GPL");
674 MODULE_ALIAS_RTNL_LINK("vti");
675 MODULE_ALIAS_NETDEV("ip_vti0");